topic Re: Search Feature For NGFW Paloalto API in Automation/API Discussions

Search Feature For NGFW Paloalto API

Bogi_Farizna — Sat, 24 Jul 2021 15:12:23 GMT

Hello Everyone..

I have a project for automation operational firewall NGFW Version 10.1..

I read the API documentation & talk to google but nothing.

My first question : Can I search specific address with specific ip_netmask value and fqdn value ? I mean about search is like contains or match in sql query.

Last question : Can I search specific rule with specific source member address value and destination member address value ?

Thanks

@Bogi_Farizna

Re: Search Feature For NGFW Paloalto API

Bogi_Farizna — Mon, 26 Jul 2021 06:10:33 GMT

Re: Search Feature For NGFW Paloalto API

JimmyHolland — Tue, 03 Aug 2021 09:38:18 GMT

Hello @Bogi_Farizna, today it would be achieved by exporting the section of config you want to search through (e.g. address objects, or rules) and filtering on the API client-side for the search term.

Re: Search Feature For NGFW Paloalto API

Bogi_Farizna — Tue, 03 Aug 2021 10:52:46 GMT

hello @JimmyHolland thanks for your attention.. so the API cannot support search for object value right ? And you suggest to exporting config for search object value, is it right ?

Re: Search Feature For NGFW Paloalto API

JimmyHolland — Tue, 03 Aug 2021 11:00:10 GMT

Today we have API operations for the various types of objects including: add, remove, edit/rename, list...

A pattern match on the returned list of address objects, for example, should be relatively simple in whatever language/script is being used to execute against the API?

Re: Search Feature For NGFW Paloalto API

Bogi_Farizna — Tue, 03 Aug 2021 11:08:30 GMT

Hello @JimmyHolland , sure, I read that API documentation PAN.. but I did'nt find the object search feature by value, but only found the search feature by name. Did I miss it?.

his is the API URL I found to search for objects by name:
https://{{host}}/restapi/v10.1/Objects/Addresses?name=Test-One&location={{location}}&vsys={{vsys}}

Re: Search Feature For NGFW Paloalto API

JimmyHolland — Tue, 03 Aug 2021 15:04:51 GMT

Hi @Bogi_Farizna, personally I use the XML API with a request like this to get all the address objects from a Panorama DeviceGroup:

https://{{host}}/api/?key={{key}}&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='{{device-group-name}}']/address

The results looks like this, so you can easily filter the results and search for name of object, or IP address of object:

Re: Search Feature For NGFW Paloalto API

Bogi_Farizna — Wed, 04 Aug 2021 03:11:39 GMT

hello @JimmyHolland , wohoo you are using XML.. ok, I know the API PAN have the ability to get all address and get by address name. but if i'm using get all address function and then filtering at client it need more time cause in my environment have more than 20k object address. so I ask you about ability API PAN to get by address value (ip-netmask or ip-range). is it possible ? if possible do you have a example request ?

Re: Search Feature For NGFW Paloalto API

JimmyHolland — Wed, 04 Aug 2021 09:28:39 GMT

I'm afraid I don't have example of that @Bogi_Farizna. If you want to discuss this with your SE/reseller/partner that would be the most appropriate next step. I can put you in touch with the right person if you want to share your company name (via DM on this forum if you wish to preserve privacy).

Re: Search Feature For NGFW Paloalto API

Bogi_Farizna — Fri, 06 Aug 2021 09:44:39 GMT

Hello @JimmyHolland , I already send my information in your dm. thnks.

Re: Search Feature For NGFW Paloalto API

JimmyHolland — Fri, 06 Aug 2021 10:36:31 GMT

Acknowledged and replied, thanks!